PT-2014-2162 · Django · Django Tastypie+1

Publicado 2014-10-27 · Atualizado 2018-07-23 · CVE-2011-4103

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Crítica

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Django Piston versions prior to 0.2.3 Django Piston versions 0.2.x prior to 0.2.2.1

Description The issue is related to the improper deserialization of YAML data in the emitters.py file, which allows remote attackers to execute arbitrary Python code via vectors related to the yaml.load method. A similar vulnerability exists in Django Tastypie.

Recommendations For Django Piston versions prior to 0.2.3, update to version 0.2.3 or later. For Django Piston versions 0.2.x prior to 0.2.2.1, update to version 0.2.2.1 or later.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2011-4103

DSA-2344-1

GHSA-PVHP-V9QP-XF5R

PYSEC-2014-24

Produtos afetados

Django Piston

Django Tastypie

Referências · 11

• https://github.com/pypa/advisory-database/tree/main/vulns/django-piston/PYSEC-2014-24.yaml · Nota
• http://debian.org/security/2011/dsa-2344 · Aviso do Fabricante
• https://djangoproject.com/weblog/2011/nov/01/piston-and-tastypie-security-releases · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=750658 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-4103 · Nota de Segurança
• https://bitbucket.org/jespern/django-piston/commits/91bdaec89543 · Correção
• https://osv.dev/vulnerability/PYSEC-2014-24 · Aviso do Fabricante
• https://bitbucket.org/jespern/django-piston · Nota
• https://osv.dev/vulnerability/GHSA-pvhp-v9qp-xf5r · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2011/11/01/10 · Nota
• https://github.com/advisories/GHSA-pvhp-v9qp-xf5r · Nota